CVE-2026-53395: nfsd: fix dead ACL conflict guard in nfsd4_create
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix dead ACL conflict guard in nfsd4create
nfsd4create() steals create->crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code:
if (create->cracl) { if (create->crdpacl || create->crpacl) / always false /
When a client encodes both FATTR4WORD0ACL and FATTR4WORD2POSIX{DEFAULT,ACCESS}ACL in the same CREATE fattr bitmap, nfsd4acltoattr() overwrites attrs.napacl/nadpacl without releasing the originals, leaking two posixacl slab objects per request. Repeated requests cause unbounded slab exhaustion.
Fix by checking attrs.nadpacl/napacl (the stolen values) instead of the nilled create->crdpacl/crpacl, matching the correct pattern already used in nfsd4setattr().
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with NFS server functionality exposed to clients are affected when they process NFSv4 CREATE requests containing both the ACL attribute and POSIX default or access ACL attributes.
What does an attacker need to exploit it?
An attacker needs network access to send crafted NFSv4 CREATE requests to the affected NFS server. No privileges or user interaction are required according to the provided CVSS vector.
What is the impact of successful exploitation?
Each crafted request can leak two posix_acl slab objects. Repeated requests can exhaust slab memory and cause a denial of service.
What should be done if patching cannot happen immediately?
Limit access to the NFS server to trusted clients and restrict network exposure to the NFS service, reducing the ability of untrusted parties to submit crafted NFSv4 CREATE requests.